Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, virtual chief information security officer at Cyber Risk Opportunities, and Jake Bernstein, partner at the law firm of K&L Gates. Visit them at cr-map.com and klgates.com.

Jake Bernstein: So Kip, what are we going to talk about today in Episode 214 of the Cyber Risk Management Podcast?

Kip Boyle: We're going to talk about a problem that's hiding in plain sight actually, and what I mean is that your security stack, everybody's security stack, was built for humans. But here come AI agents, and guess what? They don't act like humans even though some people want them to. And so what we've got to do is we've got to look at why your existing identity controls probably miss these agents and also how the tools that we're going to need to catch them and identify them and track them, those tools are changing fast. And this is all sort of in the arena of shadow AI. No doubt you've got a lot of shadow AI in your company. Everybody I've met does. And we've got a guest today who's going to help us explore this topic. Nancy Wang's here. She's the chief technology officer at 1Password. And I love 1Password. I've been using 1Password.

Jake Bernstein: How did we get her? I've used 1Password for so long. I used it before it was cool, and everybody use it.

Kip Boyle: Yes. 2012 is when I signed up for 1Password.

Jake Bernstein: Oh, that's a good long term. I don't think I was quite that old.

Nancy Wang: That's OG status.

Kip Boyle: That's right.

Nancy Wang: Yeah.

Jake Bernstein: Yeah.

Kip Boyle: Yeah, that's right. Yeah. All right. Now that you know of OG, be careful. All right? This podcast could get dangerous. But Nancy works at the edge of how machines are getting access to systems, so she's got a really clear view of how and where the old rules are breaking. Yeah, we're so happy to have you here.

Jake Bernstein: Yeah. Nancy, welcome to the podcast. This is the predictable tell us a bit about yourself and how you ended up focused on AI agents and access and how you got to be at 1Password and all that stuff section of the podcast. But I'm really excited about this. I think agents are a tremendously huge deal. I think identity and access management of agents is going to be a massive problem/opportunity space. So yeah, I'd love to hear what you've got to say.

Nancy Wang: Yeah, looking forward to it. I mean, it's such a hot topic these days. As we've seen, CIOs and many enterprise companies have gone from, "Hey, let's just block ChatGPT and Claude," to now, "Let's just give agents hats to GitHub repos and let them do their thing." So I feel like there have to be-

Jake Bernstein: What could go wrong?

Nancy Wang: Exactly, right? Besides the breaches that have recently happened. But look, we've really kind of whiplashed from one extreme to another. Finding that sensible, logical, and yet productive middle ground, well, that's what we're all about here at 1Password.

Jake Bernstein: Yeah, we experienced that too. Two years ago, all clients were saying, "Don't you dare use AI on our work product and materials." Now, they're all saying, "Don't you dare not use AI on our work product and materials."

Nancy Wang: Exactly.

Kip Boyle: Yeah, it's crazy. It's crazy how things are flipping. And no matter which way the wind's blowing, it's blowing fast.
Okay, Nancy, let's start with the core problem. As I said, when I kicked off the show, most cybersecurity teams have an identity provider. They're trusting that identity provider. Everybody gets a login. There's probably an SSO, an email address, but we know that agents are not playing ball with that model. But would you explain why that's not working?

Nancy Wang: Yeah, for sure. Maybe just taking a step back and going to the beginning a bit. Over the past however many decades, cloud identity access management has existed, or constructs like role-based access control. A lot of that was designed because fundamentally you had a human behind every action, and so a human will prove, attest to their identity like, "Hey, I'm actually Kip Boyle, and I should have all the things that Kip Boyle should have access to." They get that access, and then they go take actions.
But what's different here now is agents, and agents really changed that paradigm because... and what we say here on 1Password is, "Agents act like humans, but they work like machines," which means that they have access. We just talked about GitHub paths that any human has, but they also don't take breaks. They can work continuously. And so if you have things like long-standing privileges, let's say you give an agent an access token and also a refresh token, well, if they were malicious, they can replay that attack many times over before it's even discovered. And so in that case, you need to start understanding net new things to existing identity constructs, like who actually gave that agent the authority to do the task that it's performing, and also is that authority actually appropriate for the task at hand, and talking about access, well, should access be cut off after that task or after that action is done, and moreover, how do we do continuous monitoring to actually make sure that the intent is not drifting from the initial purpose of why this agent was even delegated authority in the first place.
And so this is the opportunity that we see emerging in the market, which is you have identity providers of yesteryear, and they're still essential, but they were really designed to authenticate people and applications. And especially when you have agents now working in the mix, you have to address the additional layer of delegated authority that is so critical to understanding if an agent should actually even be doing the thing.

Kip Boyle: Right. Okay. Now, when you talk, I think about service accounts, computers that have an account built in that can do different things. On a Unix system, they're called daemons. But is an agent more like a service account, or is it more like a human being? Is it a mashup? How would you describe that?

Nancy Wang: Yeah, that's such, I would say, a key question and really design philosophy behind all the products and announcements that you've been seeing from 1Password. The answer is really both. So if you think about my team back when I worked at AWS, we'd actually use service accounts to deploy new features or to do testing. So certainly an agent can be thought of like a service account, especially if the intended purpose is to potentially, let's say, debug production databases or to do instant response. You can certainly treat it like one. However, I think the main difference here is a service account is a static identity. The service account will always be there for that specific purpose. In this case with agents, they're ephemeral, and you have many different flavors of agents. You have, for example, browser-based agents, and that's where as 1Password, we've done integrations with browser-based, for example, and other browser-based agents as those agents are doing work on behalf of human users, let's say, buying stuff for you on amazon.com. We're there to securely inject credentials without ever revealing them to the agent. That's one example.
You also have local agents that you're creating via the likes of Cursor or other IDEs, and those agents also need access to your API keys or your SSH keys. And we also have protection there to make sure that even with, for example, that level of access needed, those credentials never land on disk and it's securely fetched or injected again through a 1Password, let's say, CLI. That's another example.
And of course, as in the world, we're proceeding towards this reality of law of the running agents. You have things like Claude Managed Agents, you have Codex agents, you have many other agents running in remote sandboxes. Well, the question there also becomes, for those agents, how do you deliver access and credentials safely without actually revealing them to the agent or even to the sandbox? It presents, again, all of these different environments through which you have to really, I think, fundamentally rethink access management and also attestation of identity.

Jake Bernstein: I distracted myself. I fully admit it. I'm guilty. But we started talking about this, and I'm like, "You know what's really funny is that lawyers have been dealing with agency for centuries." And of course I had to go find the Restatement (Third) of Agency, which what that means is it is the third time that, in this case, Thomson Reuters Westlaw, I believe is the publisher of these restatements, has gone through and consolidated centuries of law into a very large book. And I think it's fascinating that in law, agency is considered a fiduciary relationship that specifically arises when one person, the principal, in this case the actor, the actual human user, manifests assent to another person, the agent, now, of course, we already fail because we're not manifesting assent to another person but to a machine, that the agent shall act on the principal's behalf and subject to the principal's control, and the agent manifests assent or otherwise consents so to act. There you go. There's your law for the day. Now, what's so interesting about that-

Nancy Wang: I didn't know I was going to get a case law example here.

Jake Bernstein: Yeah.

Nancy Wang: This is great. Thank you.

Jake Bernstein: Because there are countless, I mean just thousands and thousands of cases across the last few hundred years of English and American common law where there is the question of, so-and-so did X on behalf of Y, did Y actually want X to do that? This is all the same problem with AI agents, except now it's happening at machine speed at scale, and the law has not... I mean, the law has a framework for dealing with this, but the rest of us have to catch up and figure out how it's going to work. Because there absolutely are going to be situations where an agent does something that the-

Kip Boyle: It's already happening.

Jake Bernstein: It's already happening. The principal was like, "Whoa, I didn't want you to do that."

Kip Boyle: I didn't say delete the database.

Jake Bernstein: I didn't say delete it, yeah. So I'm just like it's just really fascinating because now we have technologists like Nancy, security professionals like Kip, and lawyers like myself all have to come together and figure this out essentially in real time. I mean, the way I've described it very recently is we're basically finishing the plane as it hurdles down the runway and is about to take off. That's what it feels like on a daily basis. I mean, I am known for derailing podcast episodes-

Kip Boyle: Let us inaudible further derail it, right?

Nancy Wang: I mean, Jake, actually, I would actually say it's very relevant to the conversation-

Kip Boyle: It is.

Nancy Wang: ... and this is where I want to point to actually a consortium that I'm a part of that's actually doing really cool things around this concept of cyber insurance but for agents. Because cyber insurance has existed for decades, but to your point around... Not a lawyer, and so you should definitely listen to Jake on these points. But when delegated authority becomes part of the question and in cases where we're hearing about breaches or agents deleting production systems, well, who's at fault here? Who's ultimately responsible? Yeah, if you want to follow along, there's actually a lot of white papers that is called AIUC-1 is putting out, and it's really a consortium that pushes the conversation beyond just talking about model safety and into conversations like how do you govern agent behavior and also, more importantly, how do you help enterprises ensure agent behavior. We're working with companies like ElevenLabs and other AI-native labs out there.

Kip Boyle: Well, that gets us right to the subject of accountability.

Jake Bernstein: And I just found it. Yep.

Nancy Wang: Yeah, definitely. Take a look. There's going to be a white paper that's coming out very soon by one of the CISOs of an AI-native lab talking about this.

Kip Boyle: So we'll add that to the show notes, huh?

Jake Bernstein: Yeah, I just...

Kip Boyle: Jake's too busy reading.

Jake Bernstein: I found it. AIUC-1, the world's first... It's the standard for AI agent security, safety, and reliability. Look at this.

Kip Boyle: Nice.

Jake Bernstein: And of course, I'm also reminded of one of my favorite Latin phrases, foreign language. The employer is responsible for the actions of an employee when the employee's acting in scope of employment. These are all going to be super relevant to AI agents, if they're not already.

Kip Boyle: Well, let's talk about that a little bit more.

Jake Bernstein: Yeah. So I want to know from a governance view, and this is a big assumption, if an agent isn't a, quote, "user" in the system that we track, who's accountable for what it does? Where does that leave a CISO who has to answer for access? Do we even want to have agents that are not users in the system? And does that even make any sense?

Nancy Wang: So the way that we think about it... And this is where we have a bit of work that we're doing with identity providers, because identity providers will have a list of users. They have directories of users, and now machines, and for some agents as well. We can certainly take identities of those agents from the upstream identity provider, then of course through our own mechanisms, be able to do things like secure token exchange, for example, or be able to broker access to those identities just in time without revealing credentials.
But there's also work that we've been doing as well around this concept of agent identity standards. In fact, we just submitted our own opinion to NIST and IETF, and we're continuing to work with AI-native labs on this, which is this concept of a compound identity, which is where you have a human identity and then you also have the agent identity or the delegator authority part. That is then cryptographically bound to the agent identity. When, for example, you see signed claims, you'll actually be able to see who this agent belongs to and who is a human at the end of the day. That's of course one of the ways that we're thinking, about how to... maybe using some legal terminology, this chain of trust that's being established between the human and the end agent that is performing the action.

Kip Boyle: I like this idea as a way of chaining accountability. But I got to tell you that when I think about being responsible for the actions of an agent today, I want no part of it because I can't control the things adequately. This is not enough mechanism.

Jake Bernstein: I mean, Kip, that's so funny you say that because that's been the problem with humans the entire history of... I mean, you cannot perfectly control a human agent. That's why there is a Restatement (Third) of the Law Agency. So in this situation-

Kip Boyle: But I can do-

Jake Bernstein: ... you have to delegate.

Kip Boyle: Yeah. Delegation is not a problem, I can set up boundaries. So like a human being, if I have them performing maintenance on my building, I can give them keys that only let them go to the parts of the building that they're supposed to go to. I can train them and I can say, "Don't ever handle these chemicals without wearing this gear, and I can supply them with the gear."

Jake Bernstein: But they can still do all those things if they want.

Kip Boyle: They can. But if I've set them up for success, I've done everything that a manager can do, I've given them the supplies and the training, and I've done everything I can do, and they still go off the rails, well, at least I can't be accused of being negligent because I had some things that I could do and I did do them. But in the digital space right now, there's no analog for that. I really like the way I wove that in there.

Jake Bernstein: It's a good thing that we're recording this, right, Kip? Because there's good stuff. This is only 17 minutes long. It's already gold.

Nancy Wang: Yeah, and actually, from a design perspective, there's a lot of conversations around, "Well, just because you simply give an agent a prompt or even a skill," which is essentially a recipe card, if you want to think about it that way, of different prompts or different connectors that you want the agent to take.

Jake Bernstein: MCPs dramatically increase the risk profile of agents.

Nancy Wang: MCPs, yeah.

Jake Bernstein: Because they can go everywhere.

Kip Boyle: Yep.

Nancy Wang: Exactly. Ann agent might not even follow them from start to finish. And so this is where, for example... Do you guys just... Can you hear me now?

Kip Boyle: We can hear you.

Jake Bernstein: Yeah, you're good.

Nancy Wang: I think I just went offline.

Kip Boyle: No, you're good.

Nancy Wang: Okay. Well, and this is where, for example, internally, we're also thinking about methods like, for example, baking instructions directly into the SDK. So things like scope credentials, approvals, audit logging, et cetera, those are all very key to, to your point, maybe Kip, you brought this up, how you actually constrain agents to following the guardrails of exactly what you want them to do. Within, I would say, computer science, we're going to think about agents as these non-deterministic beings, but also instructions in the SDK as a form of injecting determinism into non-deterministic systems like agents.

Kip Boyle: And I like that a lot, and I do that myself whenever I want Claude to calculate some numbers and give me some totals and averages. I always tell it to write a Python script and use a well-known library because I don't trust it to do math. So that makes a lot of sense. I like that. I think that we should be looking for ways to blend deterministic with non-determinism and try to get them both working together.

Jake Bernstein: I think by definition, we must be able to do that. Because if we have no determinism with these machines, how are we supposed to have any confidence at all in what they're going to do or not do? It's a big issue right now with prompt injection style attacks. It's like everything is basically a suggestion. I mean, the AI may or may not follow its prompt. That's a real problem when you want it to know... Literally, you must follow this particular thing.
And I think what that comes down to is this question here in the script. It's like, "Is an AI agent a tool, a user? Is it something we don't have a name for?" When I think about what an AI agent is doing, particularly one that can code, I mean, the digitally we can all code, Kip. It's like your example of the person, the maintenance person, it's like you can give them keys, but that person also has a truck full of tools if they... You know what I mean? What I'm trying to say here is that an agent in many cases has a full suite of programming ability at its disposal. That could do whatever it wants in one sense.

Kip Boyle: But in the real world, if the maintenance guy grabs tools off his truck and starts demolishing my building, I can hold them accountable for that, right?

Jake Bernstein: Which I think is talking about exactly... That is my point with just bringing up the law of agency is that, yeah, you can hold them accountable for that. What is that going to look like for agents? We're not going to be able to answer that question right now.,And I think we've looked at why current identity controls can miss AI agents. Let's think about the three generations of AI security controls because-

Kip Boyle: Yeah, that was something Nancy was talking to us about during show prep. So Nancy, tell us how you see that and just walk us through it so we can understand what it looks like from your point of view.

Nancy Wang: Sure. We started talking about who an agent is or what they even are, and coming down to security controls. As many CISOs that I talked to, the best defense is when you apply a defense in dev strategy, and so you have different guardrails maybe around identity and access management, and that's certainly where one password sits. There's also, for example, controls and guardrails that you can put at the networking layer. Now, of course, we're increasingly seeing also DLP methods, which is data can't be put into certain comp windows. Data can't be set to certain endpoints. It's all part and parcel of that whole sphere as well. And increasingly, we're actually seeing, for example, some companies decide to go on-prem altogether as in, "You know what? We'll just end up buying our own boxes and racks, and we'll put it together, and no data actually ever goes in public cloud."
So we're seeing all of these different renditions of what security controls look like for different customers. And certainly customers who are more regulated also tend to be the ones who gravitate most to what they call private cloud or on-prem AI. So whatever flavor that takes, our philosophy is it really starts with access, which is understanding who you are, who the agent belongs to, what they're allowed to access, and also what they were created or what was the intention behind the creation. And so this is where you'll see, for example, our evolving thesis around, for example, different policies that the agent can follow. We talked about SCKs as one of those implementation of how do we trust agents to enact on human intent, right?

Kip Boyle: Mm-hmm.

Nancy Wang: There's going to be other methods, for example, but it all boils down to how can we stay in the loop with these agents as they're taking actions and making sure that it's still maxed back to the original intent. And upon detection of drift, how can you actually cut off access right there? What is the circuit breaker?

Kip Boyle: I think we have a real lack of tools right now, and this reminds me so much of the early stages of other major technological transformations, like mobile computing, for example. When BlackBerrys and iPhones were first starting to seep into the work world, I remember that BlackBerry was the only seller that I could go to who would actually give me a management framework that would let me control what data end up on those devices. And if the device got lost, I could go into a management console and I could remote erase it or remote lock it or whatever. iPhones had nothing like that, androids, all the other different... Nokia, whatever. And so that's what I'm hearing a lot from people as we teach right now about AI security. We have a lot of students that are just like, "Where are the tools? We got to do all this stuff, but we're not tooled."
But 1Password is doing something about it. That's what you guys are up to. So yeah, I'm just curious what part of the solution space are you guys in?

Nancy Wang: Sure. So maybe we'll start with our North Star and also our mission. And our North Star is to be the source of identities for humans, machines, and their AI agents, and also the source of trusted access.
I'll be going through each of the different populations that we serve from a human perspective. And this is super cool to me because this is actually the first consumer security company that I have worked or been a part of where if anyone from, let's say, your grandmother to your, let's say, a knowledge worker working in an office, they can use 1Password, and that's something that you really see across security tools out there, which is this very different spread in audience because it's simple, easy to use. You can use the app, whether it's on your mobile phone or it's on your desktop. We support Windows, Mac, iOS, Android, you name it. And you can simply just put your passwords in 1Password. When you go into website that needs your passwords to log in, we're there via the browser extension and we can auto-fill your passwords, and it's a super easy process. A lot of folks call us their productivity hack. That's how consumers know 1Password.
Now, moving to machines and also the developer audience. This is where, for example... I didn't actually know this before joining 1Password, but we have a very robust developer suite of products, including our CLI that's used by actually millions of developers today. We also have, as mentioned, our SDK, which allows potentially an agent to read from our vault. We also have a service account capability, which you could create a service account and map it to an agent if that is the right choice for you.
And we also have continued... For example, we just announced the launch with OpenAI Codex in the last couple of weeks where a Codex coding agent or any coding agent for that matter can use 1Password to securely access systems, tools. And what we do here is we provide a local MCP server, essentially a binary that shifts with our main desktop app that you can set up locally. And through that local MCP server, we're able to provide references to different secrets that your agent can use in order to access different tool. That was a launch that we announced with OpenAI Codex to a lot of excitement out there in the developer community, and we'll continue hardening our developer products and enable more flexibility as agents are also asked to do more things.
And then finally on the agent side, of course, that blends in very nicely to our developer audience. And these can be agents, as mentioned, that act in the browser. Oftentimes, those are going to be used by your knowledge workers who are not developers, and we can serve them as well through our agentic autofill capabilities. What I'm mapping out here is really an ecosystem of different products that, regardless of what sort of population you belong to, and many people belong across different population, whether you are using 1Password in your everyday lives to protect your own personal digital privacy and security online, or you're using 1Password as a developer because your company has bought 1Password for the entire enterprise, or you're an enterprise knowledge worker that is starting to use tools like, let's say, Claude Cowork or browser-based or other agentic browser flavors. We're also there in the browser for you.
This is essentially our promise or our commitment to our customers that we want to enable you to be secure and also secure your privacy no matter what surface you're on, and also to make security always the easy default thing to do.

Kip Boyle: Yeah, and that's important for update-

Nancy Wang: That's critical.

Kip Boyle: ... to get people to do it.

Jake Bernstein: Well, and I think you had said, Nancy, that shadow AI shows itself through the workaround that people build on their own. And we haven't actually said shadow AI yet this episode, but I think everyone knows what it is. It's unauthorized AI, it's everywhere. But tell us about this browser use example. What does that mean?

Nancy Wang: Sure. Shadow AI, maybe I'll start here because there are actually two fairly distinct topics, but there is a connection there. So maybe starting with shadow AI. Shadow AI, especially for today, if you talk to any CISO, CIO, that's probably going to be the top three concerns, which is, "I need to know what my employees are doing in the enterprise. I know, for example..." I'm not sick. Let's say, I haven't approved DeepSeek, but I'm pretty sure some of my developers are using it, and I just don't know who or even what repos they're using it on. That is something with our unified access discovery capability. We can actually show you what's happening within your enterprise, what MCP servers your developers are using or your knowledge workers are using, what AI tools they've downloaded and are using actively, and you might not know about. So what are sanctioned, what aren't sanctioned? So that's part of the shadow AI piece, which is in the security world, you have to know what you're dealing with in order to form a security strategy. You can't protect what you can't see.
Now, on the second piece, the browser agents, this is increasingly popular for knowledge workers that, for example, maybe you can't call APIs in the background. Maybe it is a point and click. If you think about the UI paths that came out in the last decade, it's very similar to that, which is let's say you want to make a restaurant booking or you have a chief of staff agent that needs to go traverse across different calendars or maybe different signup pages. Those signup pages or certainly some homegrown enterprise applications don't have clean API backends. So what happens? You need to use the UI itself, the front end, and automate those clicks or those workflows in order to accomplish a task. And so for those agents, as 1Password, we also need to be there in their path in order to securely provide them with access to credentials, but in a way that preserves our zero knowledge guarantee that we will never reveal credentials or passwords to agents or the underlying LLM model.

Jake Bernstein: Sounds easy.

Nancy Wang: Well, let's just say it's one thing that, for every feature, every launch that we do, it certainly takes longer, I'll just say that out loud, potentially multiples of durations longer than it would take us otherwise to ship a capability. But it is a cost that we willingly take on because we are serious about that commitment. And it's actually one of the things that allows us, for example... Our CISO, Jacob DePriest, published this in one of his blogs, I want to say earlier this year or late last year, where even if 1Password were to be breached, and breaches happen, we would never actually be able to reveal our customer's credentials to the hackers. And in fact, we ourselves as 1Password can never see your credentials. And that is what, at a high level, the zero knowledge architecture and guarantee is all about.
And so it has some serious implications for how we ship software in the sense that when we talk about, for example, injecting secrets or even in the recent Codex launch that we did, our references backed by our local MCP server, backed by our dev environments, it takes some extra consideration to ship those features and still adhere to our security model.

Jake Bernstein: Yeah, because just thinking logically through it, when a human uses 1Password on the web, you have to unlock your vault, and even that requires the individual's password. How do you securely send vault information to an agent? Yeah, I'm glad that's not my job because that sounds really hard.

Kip Boyle: Yeah, and the devil is in the details on this stuff, right? You can have a-

Jake Bernstein: No, it really would be because you could easily accidentally expose a user's entire vault to an agent that's like, "Oh, thank you. I'm going to go off and do stuff in your name now."

Kip Boyle: Absolutely. You can have a really well-done design, but if you don't get the implementation correct, it can completely fall on its face and mess you over.

Nancy Wang: Absolutely. And so for listeners here who are interested in how we do this, I'm happy to provide links to, for example, how we think about even... For example, our dev environments, which is we mount that file in memory so nothing lands on local disk. And we have certain protocols that we use on top of HDT that make sure that everything that we send is end-to-end encrypted. We can go on and on about different security methods that we use, this is all public, so I'm happy to share with the listeners here.

Kip Boyle: Yeah, that'd be great. I'm kind of the self-appointed timekeeper of the Cyber Risk Management Podcast.

Jake Bernstein: You definitely is.

Kip Boyle: Right now, I'm looking at the clock and I'm like, "No, we should probably start wrapping this thing up." It's a great conversation, and we could keep going for a long time. That's how I feel about all of the episodes because I really appreciate our guests, and I think there's just no lack of really interesting things to talk about.
So Nancy, if I'm a CISO at a company and I know that agents are already in my building, what would you tell them they should do? Is there a 90-day plan? Or maybe it's not time-bound, maybe it's just top three things or top five things. What are you telling people that they should do when they're in that situation?

Nancy Wang: Sure. So we have a three-step plan that we announced at RSA with some incredible partners like OpenAI, Anthropic, Vercel, and others, which is really discover, so know what you're dealing with. Agents are there. Even if, let's say, you have an AI firewall in place and you don't think AI touches any part of your enterprise, well, you probably have some employees who are using their personal ChatGPT and potentially sending data there. Just saying. So knowing is good. Knowing helps you come up with a plan to remediate. So that's number one, which is discover. We have a local endpoint presence, and so we're able to discover through all of the laptops that your employees are using, their mobile phones that they're sending Slacks on or doing email.
And then also the next step is once you know what you're dealing with, then you can come up with a defense in-depth strategy. And certainly we can be part of that strategy, especially around the identity and access layer. And there could be other layers that you want to layer on top of 1Password as well, such as the network security layer, the data security layer, of course.
And then finally, and this is where it gets really interesting, because in the yesteryears, you would just simply have API logs to understand what service called what API, when. Now, it's going to be full agent traces because an agent can take many more actions, and they don't just call APIs. They can call tools, they can call MCP servers, they can create their own information.

Kip Boyle: They can move the mouse around on my screen.

Nancy Wang: Exactly. And so you need to know, what did this agent do in this entire session? And not to scare people out there, and this is from a conversation I've had with the CTO of Temporal actually, which is what's the longest running workflow or agent that he's seen, and I think he said five days, right?

Kip Boyle: Yeah.

Nancy Wang: And so that's a pretty long session. Imagine how many actions an agent who doesn't need to sleep, who doesn't need to take breaks can do over the span of five days. So you need to know what's going on.

Kip Boyle: Right, absolutely. Okay. So you said you had a three-point plan. Is there anything else you wanted to say about it?

Nancy Wang: Sure-

Kip Boyle: Because I'm looking for the wrap up here, and I don't want to cut you off.

Nancy Wang: No, all good. So I would say discover, secure, audit. Those are our three step over a high-level plan. If you have questions around what constitutes secure access for your agents, how do I think about the identity of my agent, because most agents are still delegated authority by humans, come talk to us. Come work with us.

Kip Boyle: Cool. Okay, Jake, did you have any final words?

Jake Bernstein: I mean, too many that they would not be final, so I'm just going to have to cut myself off.

Kip Boyle: That's too bad.

Jake Bernstein: I'm employing governance principles on myself right now to end the podcast on time.

Kip Boyle: Well, that's great.

Nancy Wang: I love it inaudible instruction. Thanks.

Kip Boyle: I have to throw something at you later.

Jake Bernstein: It was not, but I'm thinking about including it in the future.

Kip Boyle: It doesn't matter. He goes off-script anyway, thinks it's worth it-

Jake Bernstein: That's true. I do. I'm basically like an agent.

Kip Boyle: ... such as suggestions.

Jake Bernstein: The prompt is a suggestion that I may or may not follow, just like an AI agent.

Kip Boyle: God. All right, this is going nowhere fast.
All right, everybody, thanks for being here. That wraps up this episode of the Cyber Risk Management Podcast. Today, we looked at why your security stack that's really built for humans isn't really optimized for AI agents. We took a look at shadow AI and also a three-point plan for what you ought to do if you're the CISO and you're looking around going, "I guess I better start taking this seriously. What should I do?"
Anyway, we did all that with our guest, Nancy Wang. She's the chief technology officer at 1Password. Thanks so much for being here, Nancy. We'll see you next time, everybody.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.